• When you enter any information anywhere on the Service, we encrypt the transmission of that information using secure socket layer technology (SSL/TLS) v1.2 by default.

• We encrypt all backups of the data. Our personal devices like mobile phones and laptops have data encryption turned on so that unauthorised users cannot access our data if the device is stolen.

• We ensure user account passwords used in our application are stored and transferred securely using encryption and salted hashing.

Security testing

• We operate a ‘bug bounty’ security program to encourage an active community of third-party security researchers to report any security bugs to us.

• We conduct rigorous penetration tests annually to ensure our service is secured against known and potential attack vectors. The tests are conducted by a reputed external security agency.

• We scan all files uploaded to our service for malware and quarantine them if required.

• Our work devices have anti-virus protection turned on by default.

Resilience

• We maintain backups at different time delays ranging from a few minutes to a few hours to a day so that we can effectively restore data to the closest recoverable point and minimise data loss in the case of a security event.

• We maintain cross cloud backups to ensure the data is accessible in case of a major outage impacting one provider.

• Backups are only retained for thirty (30) days and are securely deleted after that

• We have planned and documented disaster scenarios specific to our infrastructure and the steps needed to restore service to our users with the least possible downtime and data loss.